https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:45:11 +0000 https://db.gcve.eu/vuln/cve-2017-16355 <p>In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.</p> <p>In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.</p> https://db.gcve.eu/vuln/cve-2017-16355 https://db.gcve.eu/vuln/usn-5261-1 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: passenger</p> <p>It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder. An attacker could possibly use this issue to read arbitrary files. (CVE-2017-16355)</p> <p>It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to perform a symlink attack. An attacker could possibly use this issue to escalate privileges. (CVE-2018-12029)</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: passenger</p> <p>It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder. An attacker could possibly use this issue to read arbitrary files. (CVE-2017-16355)</p> <p>It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to perform a symlink attack. An attacker could possibly use this issue to escalate privileges. (CVE-2018-12029)</p> https://db.gcve.eu/vuln/usn-5261-1